The keys to orbit

Who controls low-Earth orbit — by law, or by physics? And how close is the collision cascade? A structural occupancy study. Not a forecast.

1 · The ascent gauntlet

Orbit is not one place; it is a stack of rings with radically different physics. Reaching anything above — navigation satellites, the Moon — means crossing every ring below. The cost of crossing changes in kind as you climb: coordinate (a maneuverable operator you negotiate with), endure (an un-owned debris field you survive), comply (a disposal norm).

2 · Who holds the keys

The occupancy picture, measured from the public satellite catalog (32,010 tracked objects, 15 July 2026) MEASURED:

The keys were minted by occupation

The keys to orbit were never issued by any treaty — no law anywhere requires anyone to coordinate with SpaceX. They were minted by occupation and they are enforced by collision risk: the shells sit across the ascent path, maneuvers invalidate everyone else's orbit predictions for days³, and ignoring SpaceX prices itself. Stated precisely: the requirement to coordinate is physically generated — by occupancy; risk-economically enforced; and legal almost nowhere. No operator-level coordination duty exists in any binding instrument.

One caveat keeps that honest, and the study carries it everywhere: "physics" alone would naturalize a chosen arrangement. The corridor is hazardous without coordination only because a voluntary, reversible deployment pattern made it so — and it stays passable only because a private operations room keeps it so. Physics is the enforcement; occupancy is the source; operations is the maintenance.

December 2025: the thread that connects everything

On 9 December 2025 a Chinese Kinetica-1 launch deployed nine satellites without — SpaceX says — coordination; on 12 December one passed within 200 meters of Starlink-6079 at 560 km⁴. Chinese researchers counter that trajectory data arrived ~14 minutes before closest approach. Within three weeks, SpaceX announced it would lower ~4,400 satellites from 550 to 480 km, explicitly citing safety reconfiguration⁵. By July 2026, the catalog shows the move nearly complete: the fleet now concentrates near 490 km — at the 1-km slot scale, nearly eight times its old peak density; averaged over the full 30-km shell, about twice MEASURED. One uncoordinated launch reshaped the geography of low-Earth orbit — and, as §3 shows, reshaped the risk math with it. The episode is also this study's natural experiment in law: an uncoordinated approach to 200 meters violated no enforceable obligation, triggered no venue, and was litigated entirely by press statement. If the compulsion were legal, that event would have had a legal life. It had none.

An unchartered utility

What kind of institution is this? The closest terrestrial analogs are not lighthouses but essential private infrastructure operating ahead of the institutions that later wrapped it — railroads before the regulators, private clearinghouses before central banking. A utility performs a function the public cannot do without; a charter is what makes depending on it tolerable: service obligations, continuity requirements, exit terms. Orbit has the utility and none of the charter — no service obligation, no rate terms, no exit conditions, no accountability for the safety function itself. In commons terms the structure is inverted twice over: SpaceX is the largest appropriator on all five disclosed bases and the sole large-scale provider of the safety infrastructure, while holding no appropriation rights (treaty law forbids title) and no provision obligations (nothing requires the maneuvering to continue).

That second inversion is the study's sharpest institutional finding: the continuity gap. A shutdown — commercial failure, sanction, war — is, institutionally, the operator-insolvency scenario, and no institution on Earth currently has both the jurisdiction and the funds to keep the suppression running through it. A bankruptcy estate optimizing creditor recovery has neither mandate nor budget for orbital safety. The engine prices what is at stake in that gap: five years after a launch stop, walking away leaves 73,113 tracked fragments in the trigger band; a responsible wind-down — deorbiting on the way out — leaves 2,407. Thirty times less debris, from institutional tidiness alone MODELED (paired draws; disposal compliance assumed 0.85–0.97, untested at fleet scale; magnitudes conditional on f_imp — the assumed fraction of dangerous close passes that become collisions; see the glossary).

The study does not stop at naming the gap. The paper now sketches the institution that would close it — call it a continuity regime (the paper's E6): a trip-wire that watches whether a fleet is still steering, not whether its owner is still solvent — so it can act while a distressed operator is still flying, not only after it walks away — paired with a ring-fenced fund, posted in advance and held outside the company, whose one job is to bring a failing fleet down. One honest piece is still missing: no third party can yet fly someone else's dead fleet down, so the design leans on catching trouble early, while the operator can still steer its own. And only one of its costs can be priced today — roughly $759 million to retire the largest fleet, and that is a floor, the smallest of several bills (flying the fleet through the wind-down, audits, independent tracking are all unpriced), never "the price of continuity" FLOOR MODELED. The avenues table in §6 places it against everything else on the board.

3 · How close is the cascade?

The honest instrument here is the CRASH Clock (Thiele, Heiland, Boley & Lawler, 2026): the expected time to a possible collision if all collision-avoidance stopped — a stress gauge, not a prediction. Their published value: 164 days in 2018; 5.5 days by June 2025; 2.5 days by May 2026² SOURCED.

Our reproduction — and what the number actually means

We reimplemented the published method independently, reproduced the paper's numbers to within rounding, then ran it on the 15 July 2026 catalog. The one honest number to carry: if collision-avoidance stopped today, the median wait to a first collision is about four days (modeled median ~4.1, range 2.9–5.7) DERIVED. Not hours — and not the sub-one-day figure the raw slot-scale rate alone would suggest.

Where the risk actually lives — two bands, two different dangers

Decomposing the no-maneuver rate by altitude MEASURED: under either treatment, the probability of a first collision lives overwhelmingly at the 480 shell (92% / 81% of the total rate; essentially all satellite-on-satellite), while the legacy debris band at 700–1,000 km carries ~1% of the trigger rate — but all the persistence. Each band earns a precise name. At 465–495 km, a fuel-limited transient cascade is possible — a genuine runaway chain while the intact fleet (the fuel) lasts: fast, self-extinguishing, its fragments flushed by drag within months to years; and the credible fast risk there is operational — screening and maneuver capacity saturating — which is severe but reversible once capacity recovers. At 700–1,000 km, where drag removes nothing on policy timescales, crossing the production-exceeds-removal threshold¹² is an effectively irreversible ratchet: reversal requires actively hauling debris out, not merely stopping. Regime-shift language belongs to that band alone — and debris settling there today commits decades of future flux down through the operating and crewed bands: classic overshoot structure, spending now, paying later.

The two-band treatment (floor = today's snapshot; coupled = elevated-rate storm scenarios) is built, seeded, and independently verified. Its knobs are ASSUMED — the elevated rates are assumed storm forcing, not measured feedback — so no coupled headline number appears here: publishing one now would be false precision. The quantity that actually decides subcritical vs supercritical is the loop gain, and that is the tunable knob of the fuller cascade engine this study's stock-flow model is the floor of.

4 · The filing race

The forward risk is not today's catalog; it is the queue — and the central finding here is that two different games are being played here, and they must never be blurred: a filing race on paper, and a deployment race in hardware. The first is real, observable, and mild. The second is conditional — and it is where the danger lives.

Game one: the paper race

A dated sequence, each item docket-anchored¹⁵ or tagged SOURCED:

Formally, this layer is a preemption game in which "file big" is close to a dominant move: filing costs almost nothing relative to the stakes, a filing acquires option value, and abstaining while rivals file costs junior queue status. The sequence above — petition to deny a rival, then file the same concept under one's own name thirteen days later, from the same beneficial owner — is not hypocrisy; both moves are best responses, and playing both is the cleanest tell in the record that the behavior is structural, not moral. The filing race by itself is rent-seeking, not tragedy: its direct harms are a distorted queue and a polluted docket. What a filing buys is also worth naming precisely, because there are two priority currencies: legal spectrum priority (queue seniority — what the filing formally acquires) and physical volume priority (occupation — which no law grants, because treaty law forbids title to space itself¹⁷, but which engineering makes absolute: a later entrant cannot fly where an incumbent already flies). The paper race is legally a race for the first currency⁶.

The accelerant: machinery that converts paper into hardware

The conversion between the two games is built into the rules meant to police the first one. Holding a filing is nearly free (one satellite, maintained ninety days, keeps an entire system's spectrum claim alive). Holding an authorization is expensive in exactly one direction: deployment milestones — 10% of a system within two years of the regulatory deadline under the international rules; 50% within six years under the US rules — enforced by bonds forfeited on a missed milestone or on surrender, so even walking away is penalized^6b. Conditional on grants, option-holders are converted into builders on a regulatory clock. The diagnosis: this is anti-warehousing machinery pointed at a physical-externality problem — it polices the mild harm (claims without satellites) with an instrument that maximizes the severe one (satellites without demand). A deadline forces deployment even when realized value turns out low; a holding price would let low-value claims die quietly.

Game two: the deployment race, mapped

Whether the hardware race becomes a genuine trap depends on a payoff nobody has demonstrated: whether orbital data centers (or any of the filed concepts) actually make money net of ordinary costs. The study's race model does not pretend to know. Instead it sweeps the whole space of assumed payoffs and maps the regions⁷. Over that swept box: roughly 69% is paper — the business case fails on ordinary cost, and the mountain of filings never becomes hardware; 17% is a race that stays below the physical threshold; 14% is the trap — profitable deployment that carries the shell past it shares of ASSUMED payoff space — parameter belief over payoff assumptions, never probabilities of the future.

The map's structure matters more than its shares. (The percentages that follow are three different cuts of the same swept box — by outcome above, by reachability and by margin here — not slices of one pie.) In 45% of the box the threshold is unreachable — demand saturates below the cliff no matter how hard the race runs. But where the cliff is reachable, the profitable window under it is razor thin: the demand level that makes deployment pay and the level that crosses the threshold typically sit within a factor of two of each other (74% of reachable draws). And the private cost of standing at the cliff edge is a few hundred dollars per satellite-year — against business cases denominated in tens or hundreds of thousands — so the market's own feedback is deterrence-relevant in well under 1% of cases. In the model's words: the race either fizzles or overshoots; nothing in it is calibrated to stop at the line. The equilibrium is not malicious — it is indifferent to the cliff, because the cliff never shows up in anyone's ledger. The honest form of the danger claim, and the only one this study makes: the collision externality is unpriced, therefore whatever entry occurs is over-entry — never "a million satellites will fly."

The heat problem — the wall every filer has to clear

The objection everyone raises first is the right one: a data center in orbit must radiate away every watt it draws — no air, no water, only infrared glow into vacuum — and radiator area is the textbook bottleneck. What do the filings say about it? Three of the four say nothing — the million-satellite filing omitted thermal design entirely (its numbers surfaced months later, in an investor-facing reveal after the comment window had closed), and Blue Origin's 51,600-satellite filing states no cooling approach at all. The one filer with docket numbers, Orbital Compute, implies a radiator shedding heat at ~1,000 W/m² — roughly six times the International Space Station's radiators (≈166 W/m²), with the million-satellite figures pointing nearer eight times flight heritage ISS SOURCED filer figures DERIVED/CLAIMED at scale UNVERIFIED.

Interlude · What comes back down

Everything launched eventually returns — and a satellite does not land, it burns, depositing its metal high in the atmosphere. So the filing race has a second ledger: not only what crowds orbit, but what rains back down. By sheer tonnage, today's whole fleet is a rounding error against nature — the sky already receives thousands of tonnes of meteoric rock a year¹³, and every returning satellite together is a fraction of it MODELED.

But bulk mass hides the sharper — and measured — finding: for several specific metals (aluminum, lithium, copper, lead), reentry-attributed mass already exceeds the meteoric source at today's fleet size, no buildout required, and reentry metals now turn up in roughly one in ten stratospheric particles sampled directly by aircraft¹⁴ MEASURED. The tonnage is small; the composition is not what the upper atmosphere evolved with. And the same milestone tiers that stress the orbital commons above would, if flown, push even the bulk rain into — and past — nature's own range. What the metal does up there — the modeled ozone and circulation claims, neither yet measured as a realized consequence — is weighed in the paper, §4.7.

5 · The strongest counter-case

Honesty requires the other side at full strength: Starlink's collision-avoidance record is clean to date, at a maneuver threshold ten times more conservative than the industry standard (collision probability 1-in-100,000 vs the usual 1-in-10,000); the move to 480 km cuts debris lifetime from years to months and was undertaken voluntarily; launch-cost collapse has democratized orbit as much as enclosed it; and the connectivity — rural, maritime, wartime — is real public value. The strongest version of this case reads the maneuver burden not as gatekeeping but as SpaceX carrying the commons' safety load. The study presents both readings and lets the structure speak.

The study gives the counter-case a sharper engine than either "gatekeeper" or "hero": the stewardship is real and incentive-explained. While the fleet is in the band, SpaceX is what economists call a privileged group — its private benefit alone pays for the public good, so the safety needs no mechanism, no altruism, and no oversight to be supplied. The fleet itself is a bond posted in kind: 10,736 satellites of collateral against its own carelessness. The clean record is structure, not virtue — which is the strongest version of the counter-case, and it cuts both ways: the same structure that explains the record explains why it is unsecured. The arrangement is incentive-compatible exactly as long as the fleet is worth protecting; the shutdown scenario in §2 is what the incentive shock looks like.

The structure also quietly disables the top of the enforcement ladder. A regulator cannot credibly threaten anything harsh enough to induce exit — ordering the fleet dark, revoking to the point of abandonment — because executing the threat inflicts the abandonment scenario on the regulator's own constituency. Sanctions are structurally capped below the exit-inducing level: too-big-to-fail, orbital edition MODELED consequence — a structure result, not event odds. The cap is not total helplessness — leverage over future filings, grants, and queue position remains real and repeated — but the heaviest tools on the shelf cannot rationally be used.

6 · Avenues

Every avenue below carries an evidence tag in the Institutions seat's discipline: Demonstrated — a real institution with a measured record; Modeled — works on paper, incentive structure specified; Aspirational — a hope without an incentive structure yet. The map's headline, before the rows: everything now in force supplies monitoring and norms; everything that would price, bond, or guarantee continuity is modeled only — zero implementations anywhere on Earth as of this writing, and zero pre-existing debris objects ever removed by anyone. The commons currently has eyes and manners, and no ledger and no will.

One tested sentence ties the table together: no single instrument unpicks both games. Run through the model, the fee moves the deployment boundary and nothing else; the holding price moves the paper-to-hardware conversion and nothing else; the bond moves the end-of-life outcome (completely, once sized right) and the deployment margin only slightly. An avenue portfolio is not a rhetorical hedge here — it is what the coverage matrix says is required.

7 · Established vs. not established

Glossary

Multipolar trap — a race in which each player's safest individual move makes everyone collectively worse off, and no one can exit alone without losing position. The study finds one conditionally: only if the deployment business case is real.
Unchartered utility — (working name) a private actor performing essential infrastructure work with none of the obligations a charter would attach: no duty to serve, no continuity requirement, no exit terms.
Privileged group — a situation where one actor's private benefit alone justifies paying for a public good, so it gets supplied without any agreement. Explains the maneuver record without heroism.
Holding price vs deadline — two ways to stop claim-hoarding: charge rent on a paper claim (low-value claims quietly die), or set a use-it-or-lose-it clock (low-value claims get built anyway). The rules in force chose the clock.

Conjunction — a close approach between two objects in orbit. "Close" here can mean under a kilometer — at closing speeds around 10 km/s.
CRASH Clock — a stress gauge: the expected time until a possible collision if every satellite stopped maneuvering. Shorter clock = less room for error. It is not a prediction that a collision will happen. The authors publish the live value at the Outer Space Institute's CRASH Clock page. "Possible collision" here means a pass within the combined hard-body size of two representative objects — the method's "10-5-10" convention: 10 m and 5 m spacecraft, 10 cm debris — not a certainty of impact.
f_imp — the assumed fraction of dangerous close passes that become actual collisions. Nobody has measured it (the zero-event record verifiably cannot pin it), so the study treats it as an assumption and flags every trajectory magnitude as conditional on it — "f_imp-conditional" means "scales with that assumption."
Kessler syndrome — a condition where collisions create debris faster than the atmosphere removes it, so each crash makes the next more likely. Even when triggered, it unfolds over decades — a slow-motion runaway, not a movie explosion. In this study the word is always band-qualified: at 700–1,000 km it names an effectively irreversible ratchet; at 465–495 km the honest terms are "fuel-limited transient cascade" and "operational saturation" — severe, but not forever.
Phase mixing — how long a tidy, slot-managed constellation would take to smear into random positions if control stopped — the crux of the 0.71-vs-1.75-day bracket in §3.

Methods & reproducibility

Every number above traces to: the Space-Track catalog snapshot (2026-07-15, 32,010 objects); the House-of-Cards v3 method, independently reimplemented and validated against its published values; seeded simulations (seed 20260715, n = 100,000) with raw draw vectors shipped; and the live workbook (0 formula errors). The full Floor — engines, results, draws, workbook, specification — publishes with the study. If a number here and a number in those files disagree, the files win — and we want to know.

Notes

1. Occupancy census: J. McDowell, GCAT — General Catalog of Artificial Space Objects (epoch 8 Jul 2026): 10,736 active Starlink of 16,234 active payloads, 2,113 of them non-maneuverable. ↩
2. S. Thiele, Heiland, Boley & Lawler, "An Orbital House of Cards," arXiv:2512.09643 (v3) / Acta Astronautica (2026); live figure at the Outer Space Institute CRASH Clock (164 d 2018 → 5.5 d Jun 2025 → 2.5 d May 2026). We cite the v3 5.5-day figure, not the earlier press number. ↩
3. COMSPOC: post-maneuver orbit-prediction error up to 40 km over several days (carried via n.2). ↩
4. SpaceNews, 16 Dec 2025, with SpaceX (Nicolls) statements 12–13 Dec 2025: a CAS Space Kinetica-1 satellite passed within 200 m of Starlink-6079 (NORAD 56120) at 560 km, "no coordination"; CAS Space counters that trajectory data were shared ~14 min before closest approach. ↩
5. Nicolls (SpaceX), 1 Jan 2026: lowering ~4,400 satellites 550→480 km through 2026, cited as a safety reconfiguration. ↩
6. The two-currencies distinction rests on primary rule texts and the docket, not on a memo: the ITU Radio Regulations RR 11.44 / 11.44C, the FCC processing-round orders, and the OST's bar on title to space itself (n.17). Filing sequence and identifiers at n.15. ↩
7. Deployment milestones: ITU Res. 35 (WRC-19); 47 CFR 25.164 (50% in 6 yr, 100% in 9) and 25.165 (surety bond forfeited on a missed milestone or on surrender). ↩
8. Deployment-race model — this study's own engine: race_model_d3b.py, seed 26716, 2,000-row raw sweep shipped and reproduced byte-identically; all payoffs are assumed and swept, so the region shares are shares of the assumed box, not probabilities. Engine and draws ship in the Floor. ↩
9. A. Rao, D. Burgess & D. Kaffine, "Orbital-use fees could more than quadruple the value of the space industry," PNAS (2020): dynamic optimal fee ≈ $235k/sat-yr by 2040; removal without incentive reform recovers ≤ 9.5% of lost value. Reinforced by A. Rao & G. Rondina, "The Economics of Orbit Use: Open Access, External Costs, and Runaway Debris Growth," JAERE 12(2) (2025) (preprint): fully internalizing the launch externality is still insufficient under autocatalytic debris growth. Our static fee (≈ $231/sat-yr) is a floor on their dynamic figure, not an estimate of it. ↩
10. Occupancy and density are measured from the U.S. Space Force Space-Track element catalog (full pull 15 Jul 2026, 32,010 objects): the five bases (38.7% of tracked LEO objects, 66.1% of active payloads, 95.0% of the 465–495 km density, 97.9% of the modeled no-maneuver collision rate), OneWeb's 654, and the 10,742 Starlink name-lines. ↩
11. Mass-share base: J. Bennett & N. Cudney, "Holding up the skies," Territory, Politics, Governance (2026) — 52.0% of operational-satellite mass in LEO (underlying census May 2023, stale-flagged); it is not a share of all mass in orbit, which is where the source's own abstract slipped. ↩
12. Maneuver counts: SpaceX FCC semiannual constellation reports (144,404 Dec 2024–May 2025; 148,696 Jun–Nov 2025, ≈ 800/day), via Space Intel Report. ↩
13. The published runaway threshold is for the higher shells: H. Lewis & D. Kessler, "Critical Number of Spacecraft in Low Earth Orbit," Proc. 9th European Conf. on Space Debris (Bonn, 2025), paper 305 — at or above threshold 520–1000 km. It does not speak to the 480-km shell; every 480-km criticality figure here is ours, modeled. ↩
14. Natural infall: J. Rojas, J. Duprat et al., "The micrometeorite flux at Dome C (Antarctica)," Earth and Planetary Science Letters 560 (2021), 116794 — ~15,000 t/yr of meteoric material entering the atmosphere (method-to-method range ~2,000–110,000 t/yr). ↩
15. Reentry-metal deposition: D. Murphy et al., PNAS 120(43) (2023), e2313374120 — ~10% of stratospheric aerosol particles > 120 nm carry reentry metals; for Li, Al, Cu and Pb the reentry-attributed mass already exceeds the meteoric source at today's fleet size (direct aircraft sampling, measured). ↩
16. The 2026 filing docket (FCC ICFS): SpaceX ODC SAT-LOA-20260108-00016 (accepted DA-26-113); Blue Origin "Project Sunrise" SAT-LOA-20260310-00118; Orbital Compute SAT-LOA-20260624-00251; SpaceX Gen3 SAT-LOA-20260630-00264; petitions to deny by Amazon, Blue Origin and Viasat (6 Mar). ↩
17. Active-removal frontier: JAXA CRD2 (rendezvous with a non-cooperative upper stage; observation only, no capture) and Astroscale ADRAS-J (a ~15 m approach with an autonomous abort before capture, Dec 2024). No pre-existing derelict has been removed by a third-party servicer as of mid-2026. ↩
18. Occupation without title: Outer Space Treaty, Arts. II, VI, IX (no national appropriation; state responsibility and continuing supervision). Seed observation: A. Lawler & A. Boley, The Conversation, 13 Jul 2026. ↩
19. The continuity-regime (E6) analogs are demonstrated instruments in other domains: bank Prompt Corrective Action (12 U.S.C. §1831o), officer certification under penalty (SOX §906, 18 U.S.C. §1350), the nuclear-decommissioning trust (NRC 10 CFR 50.75), resolution plans (Dodd-Frank Title I) and an orphan-tail levy (SMCRA Abandoned Mine Land). The ≈ $71k per-satellite disposal unit cost and the ~$759M census trust principal are this study's engine outputs (Floor). ↩